CVEs published September 28, 2022
73 CVEs were published on September 28, 2022: 11 critical, 20 high. Browse them by severity, product and exploitation status.
- Published
- 73
- Critical
- 11
- High
- 20
- Medium
- 31
- Low
- 8
- Unrated
- 3
- Now in CISA KEV
- 0
- Fix available
- 35
Most affected products
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller · C…
- 11
- Smart eVision Information Technology Smart eVision
- 7
- Trend Micro Deep Security
- 4
- Dell Networking OS10
- 3
- matrix-org matrix-js-sdk · matrix-js-sdk
- 3
- bytebase · github.com/bytebase/bytebase
- 2
- ikus060/rdiffweb · rdiffweb
- 2
- matrix-org matrix-android-sdk2 · org.matrix.android:matrix-…
- 2
- matrix-org matrix-ios-sdk
- 2
- PHP Group PHP
- 2
Critical 11
- CVE-2022-40942Tenda TX3 US_TX3V1.0br_V16.03.13.11 is vulnerable to stack overflow via compare_parentcontrol_time.
- CVE-2022-28814Path traversal in Carlo Gavazzi UWP 3.0 could lead to full device accessCarlo Gavazzi UWP 3.0 Monitoring Gateway and Controller · C…
- CVE-2022-28812Use of Hard-coded Credentials in UWP3.0 allows SuperUser authentication bypass in Car Park Server.Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller · C…
- CVE-2022-28811Possible command injection in Car Park Server in Carlo Gavazzi UWP3.0Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller · C…
- CVE-2022-22526Missing authentication for API in Carlo Gavazzi UWP 3.0 Car Park ServerCarlo Gavazzi UWP 3.0 Monitoring Gateway and Controller · C…
- CVE-2022-22524SQL-injection in Carlo Gavazzi UWP 3.0 allows for full database accessCarlo Gavazzi UWP 3.0 Monitoring Gateway and Controller · C…
- CVE-2022-22522Hard-coded credentials in Carlo Gavazzi UWP3.0 allows for authentication bypass and full control of the deviceCarlo Gavazzi UWP 3.0 Monitoring Gateway and Controller · C…
- CVE-2022-40083Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component.github.com/labstack/echo/v4
- CVE-2022-30935An authorization bypass in b2evolution allows remote, unauthenticated attackers to predict password reset tokens for any user through the…
- CVE-2022-39033Smart eVision - Path Traversal -1Smart eVision Information Technology Smart eVision
- CVE-2022-40929XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks.com.xuxueli:xxl-job-core
High 20
- CVE-2022-39257Matrix iOS SDK vulnerable to impersonation via forwarded Megolm sessionsmatrix-org matrix-ios-sdk
- CVE-2022-39255Matrix iOS SDK vulnerable ton Olm/Megolm protocol confusionmatrix-org matrix-ios-sdk
- CVE-2022-34424Networking OS10, versions 10.5.1.x, 10.5.2.x, and 10.5.3.x contain a vulnerability that could allow an attacker to cause a system crash by…Dell Networking OS10
- CVE-2022-39248matrix-android-sdk2 vulnerable to Olm/Megolm protocol confusionmatrix-org matrix-android-sdk2 · org.matrix.android:matrix-…
- CVE-2022-39246matrix-android-sdk2 vulnerable to impersonation via forwarded Megolm sessionsmatrix-org matrix-android-sdk2 · org.matrix.android:matrix-…
- CVE-2022-3215NIOHTTP1 and projects using it for generating HTTP responses can be subject to a HTTP Response Injection attack.Swift Project SwiftNIO
- CVE-2022-36448An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2022-22525Command injection in restore function of Carlo Gavazzi UWP3.0 allows for command injectionCarlo Gavazzi UWP 3.0 Monitoring Gateway and Controller · C…
- CVE-2022-22523Carlo Gavazzi UWP 3.0 WebApp allows for authentication bypassCarlo Gavazzi UWP 3.0 Monitoring Gateway and Controller · C…
- CVE-2022-40082Hertz v0.3.0 ws discovered to contain a path traversal vulnerability via the normalizePath function.github.com/cloudwego/hertz
- CVE-2022-40486TP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel.
- CVE-2022-32168notepad-plus-plus - DLL Hijackingnotepad-plus-plus
- CVE-2022-39032Smart eVision - Improper Privilege ManagementSmart eVision Information Technology Smart eVision
- CVE-2022-39030Smart eVision - Exposure of Sensitive Information to an Unauthorized Actor -2Smart eVision Information Technology Smart eVision
- CVE-2022-1270In GraphicsMagick, a heap buffer overflow was found when parsing MIFF.GraphicsMagick
- CVE-2022-28813SQL-injection in Car Park Server 3.0 allows for full database access.Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller · C…
- CVE-2022-39249Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessionsmatrix-org matrix-js-sdk · matrix-js-sdk
- CVE-2022-39251Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusionmatrix-org matrix-js-sdk · matrix-js-sdk
- CVE-2022-39261Twig may load a template outside a configured directory when using the filesystem loadertwigphp Twig · twig/twig +1
- CVE-2022-39264nheko vulnerable to secret poisoning using MITM on secret requests by the homeserverNheko-Reborn nheko
Medium, low and unrated 42
- CVE-2022-3326Weak Password Requirements in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-31629$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilitiesPHP Group PHP
- CVE-2022-31628phar wrapper can occur dos when using quine gzip filePHP Group PHP
- CVE-2022-40710A link following vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local…Trend Micro Deep Security
- CVE-2022-40709An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a…Trend Micro Deep Security
- CVE-2022-40708An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a…Trend Micro Deep Security
- CVE-2022-40707An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a…Trend Micro Deep Security
- CVE-2022-39263NextAuth.js Upstash Adapter missing token verificationnextauthjs next-auth · @next-auth/upstash-redis-adapter
- CVE-2022-34394Dell OS10, version 10.5.3.4, contains an Improper Certificate Validation vulnerability in Support Assist.Dell Networking OS10
- CVE-2022-29089Dell Networking OS10, versions prior to October 2021 with Smart Fabric Services enabled, contains an information disclosure vulnerability.Dell Networking OS10
- CVE-2022-3292Use of Cache Containing Sensitive Information in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-23716A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in…Elastic Cloud Enterprise
- CVE-2022-36781ConnectWise - ScreenConnect Session Code BypassConnectWise ScreenConnect
- CVE-2022-3287When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without…fwupd
- CVE-2022-3193An HTML injection/reflected Cross-site scripting (XSS) vulnerability was found in the ovirt-engine.ovirt-engine
- CVE-2021-41434A stored Cross-Site Scripting (XSS) vulnerability exists in version 1.0 of the Expense Management System application that allows for…
- CVE-2022-38934readelf in ToaruOS 2.0.1 has some arbitrary address read vulnerabilities when parsing a crafted ELF file.
- CVE-2022-36771IBM QRadar User Behavior Analytics could allow an authenticated user to obtain sensitive information from that they should not have access…IBM QRadar User Behavior Analytics
- CVE-2022-35722IBM Jazz for Service Management is vulnerable to stored cross-site scripting.IBM Jazz for Service Management
- CVE-2022-35282IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF).IBM WebSphere Application Server
- CVE-2022-22387IBM Application Gateway is vulnerable to cross-site scripting.IBM Application Gateway
- CVE-2022-3354Open5GS UDP Packet ogs-tlv-msg.c denial of serviceOpen5GS
- CVE-2022-40912ETAP Lighting International NV ETAP Safety Manager 1.0.0.32 is vulnerable to Cross Site Scripting (XSS).
- CVE-2022-28816Reflected XSS in Carlo Gavazzi UWP 3.0Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller · C…
- CVE-2022-28815SQL-Injection in Carlo Gavazzi UWP 3.0 Sentilo ProxyCarlo Gavazzi UWP 3.0 Monitoring Gateway and Controller · C…
Show all 42 entriesShow fewer entries
- CVE-2022-3349Sony PS4/PS5 exFAT UVFAT_readupcasetable heap-based overflowSony PS4 · Sony PS5
- CVE-2022-32169bytebase - Improper Authorizationbytebase · github.com/bytebase/bytebase
- CVE-2022-32170bytebase - Improper Authorizationbytebase · github.com/bytebase/bytebase
- CVE-2022-32166ovs - buffer over-readovs
- CVE-2022-3348Exposure of Sensitive Information to an Unauthorized Actor in tooljet/tooljettooljet/tooljet
- CVE-2022-3333Zephyr Project Manager REST Call cross site scriptingZephyr Project Manager
- CVE-2022-3332SourceCodester Food Ordering Management System POST Parameter router.php sql injectionSourceCodester Food Ordering Management System
- CVE-2022-39054COWELL INFORMATION SYSTEM CO., LTD. enterprise travel management system - Reflected XSSCOWELL INFORMATION SYSTEM CO. enterprise travel management…
- CVE-2022-39053HEIMAVISTA INC. Rpage - Reflected XSSHEIMAVISTA Rpage
- CVE-2022-39035Smart eVision - Stored XSSSmart eVision Information Technology Smart eVision
- CVE-2022-39034Smart eVision - Path Traversal -2Smart eVision Information Technology Smart eVision
- CVE-2022-39031Smart eVision - Exposure of Sensitive Information to an Unauthorized Actor -3Smart eVision Information Technology Smart eVision
- CVE-2022-39029Smart eVision - Exposure of Sensitive Information to an Unauthorized Actor -1Smart eVision Information Technology Smart eVision
- CVE-2022-38699ASUS Armoury Crate Service - Arbitrary File Creation via Elevation of Privilege FlawASUS Armoury Crate Service
- CVE-2021-43980Apache Tomcat: Information disclosureApache Software Foundation Apache Tomcat · org.apache.tomca…
- CVE-2022-2760In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an…Octopus Deploy Octopus Server
- CVE-2022-39236Matrix Javascript SDK improper beacon events can cause availability issuesmatrix-org matrix-js-sdk · matrix-js-sdk